Privacy Policy

The controller of your personal data is:

• Account details — your email address and sign-in details (or your Google account email if you sign in with Google).
• Orders — what you bought, prices, delivery charge, totals, your name and delivery address for physical orders, payment status and payment references from Stripe (we never see or store your full card details), refunds, dispatch details such as courier and tracking, and any payment disputes.
• Digital resources — which resources your account can access, any changes to that access, and the record of your immediate-access request (the wording version and time) when you buy.
• Resource access records — which resource files your account opened, when first and last opened, and how many times. We don't record IP addresses or device details for this.
• Enquiries — your name, email, optional phone number and message when you contact us or send a bulk/bundle enquiry.
• Restock requests — your email when you ask to be told a bundle is back.
• Email records — a record of each order email we send you (recipient, type, whether it was delivered).
• Admin and security records — internal notes about orders or access and records of admin actions, kept for security and to handle disputes.

• To provide what you buy (accounts, orders, delivery, digital access, order emails) — performance of our contract with you.
• To keep accounting and tax records, and the evidence of your digital-content acknowledgement — legal obligation.
• To prevent fraud and misuse, keep the service secure, handle refunds, disputes and complaints, and protect our legal position (including resource access records and admin records) — our legitimate interests.
• To answer your enquiries and send restock notices you've asked for — our legitimate interests in responding to you (or steps you ask us to take before a contract).

We don't send marketing emails and we don't sell your data.

• Lovable — hosts our website, database, sign-in and file storage.
• Stripe — processes payments, refunds and disputes.
• Resend — delivers our order emails.
• Google — only if you choose to sign in with Google.
• Couriers — your name and delivery address when we post a physical order.
• Professional advisers, or authorities where the law requires it.

Some of these providers may process data outside the UK. Where personal data is transferred outside the UK, it must be protected by the safeguards UK data protection law requires. Contact us for more information.

• Orders, payments and refunds — for the period required by accounting and tax law.
• Digital access and acknowledgement records — while you have access, and afterwards for as long as needed to evidence the purchase and handle any claim.
• Everything else (enquiries, restock requests, email and access records, admin records) — only as long as reasonably necessary for the reason we collected it, our legal obligations, dispute handling, security and fraud prevention, or establishing or defending legal claims.

If you close your account, we remove your account and digital access, but we keep transaction and legal records we still have a lawful reason or obligation to retain.

You have the right to access your data, have it corrected, have it erased, restrict or object to how we use it, and receive it in a portable format — subject to legal exceptions. To use any right, or to complain to us about how we've handled your data, email support@nyrosupplies.com. We'll respond within the time the law requires.

You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. We'd appreciate the chance to deal with your concern first.

We only use storage that's strictly necessary: your sign-in session, your cart, a temporary note of where to return after sign-in, and — on checkout pages only — Stripe's payment and fraud-prevention technology. We use no analytics, advertising or tracking, and no tracking in our emails. Our fonts are served from our own website. See Cookies.

We'll update this policy if how we use personal data changes, and show the date at the top.